NetSec-Pro Practice Test 10 — 10 Questions

Question 1

Which TWO actions should an administrator perform to prepare for a large-scale firmware upgrade across an enterprise using Panorama?

Accepted Answer

Upload the firmware images to Panorama.. Option B is correct because Panorama must have the target PAN-OS firmware images uploaded to it (via Device > Software or the Panorama software manager) so they can be pushed to managed firewalls during a large-scale upgrade. Option C is correct because the Compatibility Matrix must be verified to confirm that each firewall model supports the target PAN-OS release and that the required base image and upgrade path are valid before deploying enterprise-wide. Option A is wrong because deleting logs does not prepare firmware images or validate upgrade paths and could destroy audit data. Option D is wrong because disabling security policies is unnecessary and would create a security gap during the upgrade. Option E is wrong because manually SSHing into every firewall is not scalable or required; Panorama can check and report disk space and readiness across managed devices.

Answer

Delete all old logs to free up space.

Answer

Disable all security policies.

Answer

Manually SSH into every firewall to check disk space.

Question 2

An administrator is configuring a SASE solution with Palo Alto Networks Prisma Access. The goal is to ensure that traffic from remote users to SaaS applications is inspected for threats while optimizing performance. Which two components are required to achieve this? (Choose two.)

Accepted Answer

Prisma Access security processing node (SPN) in the closest region. To secure remote user traffic to SaaS applications with Prisma Access, a GlobalProtect app on user devices establishes the connection, and a Security Processing Node (SPN) in the closest region performs security inspection and optimizes routing. These two components are essential for SASE security and performance.

Answer

A dedicated VPN concentrator in the data center

Answer

Explicit proxy configuration on the remote user's device

Answer

SD-WAN devices at branch offices

Question 3

An administrator is using the Palo Alto Networks Expedition tool to migrate a configuration from a competitor firewall to a Palo Alto Networks firewall. After importing the competitor's configuration, the administrator notices that some rules are not being translated correctly. Which step should the administrator take to improve the translation accuracy?

Accepted Answer

Use the Expedition migration tool's built-in parser and adjust the translation settings.. Expedition is a free tool from Palo Alto Networks designed to help migrate configurations from other vendors. It uses parsers to translate rules, objects, and policies. If translations are incorrect, the administrator can adjust the translation settings, such as mapping services and applications, or use the tool's built-in validation and suggestion features. This iterative process improves accuracy. Manually rewriting rules or using unsupported methods is not recommended.

Answer

Export the configuration to a CSV file and import it into Panorama.

Answer

Disable rule translation and rely on manual entry.

Answer

Manually rewrite all rules from scratch.

Question 4

A network security administrator is using the Palo Alto Networks Best Practice Assessment (BPA) tool to evaluate the security posture of a firewall. The BPA report shows a low score in the 'Security Policy' category due to overly permissive rules. Which action should the administrator take to improve the score while maintaining necessary access?

Accepted Answer

Replace 'any' applications with specific applications and narrow the source and destination addresses.. The Best Practice Assessment (BPA) tool evaluates firewall configurations against Palo Alto Networks best practices. A low score in 'Security Policy' often indicates overly permissive rules, such as those using 'any' application or broad source/destination. To improve the score, the administrator should replace 'any' with specific applications and narrow addresses to only what is necessary. This maintains required access while making the policy more secure and aligned with best practices.

Answer

Create a new rule to deny all traffic and place it at the top.

Answer

Disable logging on the permissive rules to reduce log volume.

Answer

Enable all security profiles on the permissive rules.

Question 5

A network administrator is troubleshooting a Palo Alto Networks firewall and needs to verify which security policy rule is allowing or denying a specific session. The administrator wants to see the rule name and the action taken for a particular flow. Which CLI command should be used?

Accepted Answer

test security-policy-match application web-browsing source 10.1.1.1 destination 10.2.2.2 destination-port 80 protocol 6. The 'test security-policy-match' command is specifically designed to simulate a policy lookup and show which security policy rule matches a given set of flow parameters. It returns the rule name and the action, making it ideal for troubleshooting why traffic is allowed or denied. Other commands either show session details without the rule or display the entire policy without evaluating a specific flow.

Answer

show session all filter source 10.1.1.1 destination 10.2.2.2

Answer

show running security-policy

Answer

debug dataplane policy

Question 6

An administrator is configuring a Site-to-Site VPN and needs to ensure that the tunnel interface is included in the routing table. What must be done to ensure traffic can be routed across the tunnel?

Accepted Answer

Add a static route in the Virtual Router pointing to the remote subnet using the tunnel interface as the next hop.. For a route-based Site-to-Site VPN, the tunnel interface must be reachable via the routing table. Adding a static route in the Virtual Router that points to the remote subnet with the tunnel interface as the next hop ensures traffic destined for the remote network is directed into the VPN tunnel. Without this route, the firewall has no path to send encrypted traffic.

Answer

Configure the tunnel interface in a separate security zone.

Answer

Change the tunnel interface type to Layer 3.

Answer

Enable Proxy-ID settings on the tunnel interface.

Question 7

Which THREE of the following are valid Security Profile types?

Accepted Answer

URL Filtering. URL Filtering (B) is a valid Security Profile type because it enforces web access policy by categorizing URLs and applying allow/block/alert actions per category. Vulnerability Protection (D) is a valid Security Profile type that inspects traffic for exploits and applies signatures with actions such as block, alert, or reset. Anti-Spyware (E) is a valid Security Profile type that detects and blocks spyware, C2 callbacks, and other malicious traffic using signatures and DNS sinkholing. Zone Routing (A) is not a Security Profile type; it is a network configuration concept related to zones and routing. Policy Optimizer (C) is not a Security Profile type; it is a tool for reviewing and tightening security policy rules, not a profile applied to traffic inspection.

Answer

Zone Routing

Answer

Policy Optimizer

Question 8

An administrator is unable to download content updates. The firewall has valid internet access, but the management interface has no route to the update server. What is the best solution?

Accepted Answer

Configure a Service Route to use a data-plane interface.. The management interface on a Palo Alto Networks firewall uses a separate routing table (management plane) that does not share routes with the data plane. By default, dynamic updates (content, antivirus, etc.) are sourced from the management interface. If the management interface lacks a route to the update server, configuring a Service Route to use a data-plane interface (e.g., ethernet1/1) allows the firewall to send update traffic out through the data plane, which has internet access. This is the correct and standard solution to resolve the routing issue without altering the management IP or firmware.

Answer

Upgrade the PAN-OS firmware.

Answer

Change the management IP address.

Answer

Disable SSL inspection on the management traffic.

Question 9

Which THREE of the following are settings that can be configured in a URL Filtering profile?

Accepted Answer

Category-based blocking. In a Palo Alto Networks URL Filtering profile, category-based blocking (B) is a core setting that lets you set actions (allow, block, alert, continue, override) per URL category, so it is correct. Block/Allow lists (D) are also configurable in the URL Filtering profile, allowing specific URLs or domains to be explicitly permitted or denied regardless of category. Credential phishing protection (E) is a URL Filtering profile setting that blocks phishing sites attempting to steal credentials, making it correct. Antivirus scanning (A) belongs to the Antivirus security profile, and File blocking (C) belongs to the File Blocking profile, so neither is configured within a URL Filtering profile.

Answer

Antivirus scanning

Answer

File blocking

Question 10

Which THREE of the following items are required to successfully deploy a Prisma Access Service Connection?

Accepted Answer

Service connection name. When configuring a Prisma Access Service Connection, you must provide a Service connection name (B) to uniquely identify the connection within the Prisma Access infrastructure, as it is a mandatory field in the service connection configuration workflow. You must also specify the Destination IP range (D), which defines the internal/on-premises networks that Prisma Access should route traffic to through the service connection. Additionally, a BGP or Static Route configuration (E) is required because the service connection needs a routing method to exchange or define routes between Prisma Access and the customer's network (BGP peering or static routes). The other options are not required: a user authentication list (A) is unrelated to service connection deployment (it pertains to user identification/authentication policies), and the Prisma Access Gateway IP (C) is not a value you supply for a service connection; gateway IPs are assigned by Prisma Access rather than being an input requirement.

Answer

User authentication list

Answer

Prisma Access Gateway IP